# What Are Persistence and Command & Control (C2)? How Does an Attacker Stay in the Network?

**URL:** https://securesys.com.tr/en/learning/red-teaming-threat-intelligence/what-are-persistence-and-command-and-control-c2

![What Are Persistence and Command & Control (C2)? How Does an Attacker Stay in the Network?](/images/bilgi-merkezi/covers/cover-redteam-09.webp)

An attacker gaining initial access to an organisation, moving to other systems and obtaining high privileges are all important stages.

But for an advanced threat actor there is another critical objective:

**Not losing that access.**

One-off access is not always enough for an attacker.

A user password can be changed.

An endpoint can be restarted.

An EDR can stop a process.

The SOC can disable a suspicious account.

The network connection can be cut.

The attacker therefore tries to develop methods that will preserve their access as far as possible.

This stage is called **persistence**.

But being able to remain inside a system is not enough on its own.

The attacker also needs to communicate with the systems they have compromised, send commands and manage the operation.

That communication mechanism is called **command & control (C2 or C&C)** in cyber security literature.

In Red Team operations, persistence and command & control matter for testing not only whether the attacker can get in, but **how long they can remain unseen inside the organisation and keep communicating**.

Persistence, C2, EDR, XDR, NDR, SIEM, SOC and detection engineering are therefore directly connected concepts in modern attack simulations.

#### What Is Persistence?

**Persistence** describes the methods an attacker uses to maintain their access on a target system or corporate network.

Within the MITRE ATT&CK framework, persistence is treated as a distinct tactic.

The purpose is simple:

**To be able to reach the system again even if the initial access is lost.**

The attacker may, for instance, have compromised a user account.

But when that user's password is changed, the access can end.

The attacker therefore tries to create a different access mechanism.

Persistence techniques can appear at operating system, identity system, cloud environment or application level.

The critical point for the defence is this:

**Cleaning up the initial access does not always mean the attacker has been removed from the environment entirely.**

### Why Does Persistence Matter?

Many organisations approach a security incident like this:

A suspicious user account is identified.

The password is changed.

The computer is reimaged.

The alert is closed.

The incident is considered finished.

But if the attacker has created another persistence mechanism, the access can continue.

A different user account may have been created.

An access point may have been left on another system.

A new permission may have been granted in the cloud environment.

A service or scheduled task may have been created.

During incident response, therefore, solving only the problem first reported is not enough.

**Persistence hunting** must be carried out.

### The Difference Between Persistence and Initial Access

These two concepts are frequently confused.

**Initial access** is the attacker's first entry method into the organisation.

**Persistence** is the method of maintaining that access.

For example;

compromising a user account through phishing may be initial access.

Creating a different access method afterwards may be persistence.

This distinction matters particularly in MITRE ATT&CK-based security analysis.

Because the detection methods used for the two stages can be different.

### How Can Persistence Be Achieved?

Persistence can be achieved through many different methods.

The techniques vary by operating system and environment type.

In general attackers may consider areas such as;

- creating new users or accounts,
- changing existing account privileges,
- scheduled task mechanisms,
- service configurations,
- startup mechanisms,
- cloud identity changes,
- application or access keys,
- token and credential-based methods.

Each offers a way back in.

The purpose here is not to teach how the attack is carried out, but to understand which behaviours the defence needs to monitor.

Because many persistence methods can resemble normal IT administration activity.

That makes detection difficult.

### Why Is the Creation of a New User Account a Critical Signal?

Creating a new user is a normal operation in an organisation.

HR reports a new employee.

IT opens the account.

But an account being created at an unexpected time or on an unexpected system can be an important security signal.

The risk grows further if it occurs alongside;

highly privileged group membership,

an administrator role,

remote access rights,

service access.

Any of those combinations deserves attention.

SOC teams should therefore monitor not only login events but **identity lifecycle event** records as well.

### Scheduled Tasks and Persistence

Scheduled tasks in operating systems are entirely legitimate features.

Backup operations,

update processes,

automated scripts,

system maintenance

can all use these mechanisms.

But attackers can also take advantage of legitimate system features to maintain access.

This approach can be part of **living off the land (LotL)** behaviour.

From the defensive side, what matters is not the existence of a scheduled task but its context.

For example;

which user created it,

on which endpoint it appeared,

which process it runs,

at what time it triggers,

whether similar behaviour has been seen before

are all important questions.

### What Is Service-Based Persistence?

On Windows and Linux systems, services are a fundamental part of system operations.

Once an attacker obtains privileges they may try to abuse service configurations.

For that reason;

the creation of a new service,

changes to an existing service,

unexpected binary path changes,

suspicious service starts

are valuable signals for EDR and SIEM.

Here again the critical point is behavioural analysis.

Because system administrators also create services during normal operations.

Detection engineering teams should therefore assess user, system and time context together rather than raising a simple “a service was created” alert.

### What Is Cloud Persistence?

Modern attacks no longer take place only on Windows endpoints.

Persistence is an important topic in cloud environments too.

An attacker may try to create;

a new cloud identity,

a service principal,

an application permission,

an access key,

an API token,

a role assignment.

Any one restores their foothold.

In this way, even if the user's password is changed, a different route into the cloud environment can persist.

**Cloud security, IAM security and identity threat detection** have therefore become critical for persistence.

Identity and permission changes must be monitored continuously, particularly in Azure, AWS and Microsoft 365 environments.

### Why Does Microsoft 365 Persistence Matter?

Microsoft 365 hosts critical business processes for many organisations, such as;

email,

documents,

Teams,

SharePoint,

OneDrive.

An attacker reaching a Microsoft 365 account therefore creates serious risk.

Persistence should not be thought of in terms of passwords alone.

Organisations should also monitor activity such as;

new application consent,

suspicious OAuth permissions,

mailbox rule changes,

unexpected forwarding settings,

new privileged role assignments.

Changes of this kind can help an attacker remain unseen on a user account for far longer.

### Why Do Mailbox Rules Matter for Security?

Email systems provide mailbox rule mechanisms so users can manage messages automatically.

Emails from a particular sender can be moved to a folder automatically, for instance.

That is a normal feature.

But once an attacker reaches an account they may try to change rules in order to hide certain messages or forward them to a different address.

In Microsoft 365 security, therefore, activity such as;

mailbox forwarding,

inbox rule creation,

external forwarding

must be monitored by the SOC.

These signals can be critical on finance and executive accounts in particular.

### What Is Command & Control (C2)?

**Command & control (C2)** is the mechanism that allows an attacker to communicate with the systems they have compromised and manage the operation.

Put simply:

The attacker has compromised the system.

But how will they send commands to it?

How will they receive the results?

How will they issue new tasks?

C2 is that communication channel.

Within MITRE ATT&CK, command and control is defined as a distinct tactic.

An attacker holding persistent access to a system can be operationally limited if the C2 channel does not work.

Persistence and C2 are therefore complementary concepts.

### Why Does C2 Matter?

Through C2 the attacker can remotely;

obtain information about the system,

send commands,

manage the operation,

select new targets,

maintain access.

It is the operational backbone of the intrusion.

But keeping C2 traffic invisible on the network is a critical problem for the attacker.

Because the organisation's security solutions such as;

firewall,

proxy,

NDR,

IDS/IPS,

EDR,

XDR,

SIEM

are all trying to detect that communication.

Modern attackers therefore try to make C2 traffic resemble normal network traffic.

Defensive teams in turn must look not only at known bad IP addresses but at **behavioural network anomalies**.

### Are C2 and Malware the Same Thing?

No.

Malware refers to malicious software.

C2 refers to the communication structure between the attacker and the compromised system.

A piece of malware may communicate with a C2 server.

But not every C2 behaviour requires malware in the classic sense.

Legitimate management tools or other communication channels can be abused.

In the modern security approach, detecting malicious files alone is therefore not enough.

**Behaviour-based detection** matters.

### What Is Beaconing?

One of the concepts frequently encountered in C2 security is **beaconing**.

Beaconing is the behaviour of a compromised system communicating with external control infrastructure at regular intervals.

If an endpoint;

connects to the same external destination at regular intervals,

sends very small data packets,

uses similar time intervals,

that behaviour can be suspicious from a C2 perspective.

But normal software can also make regular connections.

Update services,

cloud agents,

monitoring systems

can produce similar traffic.

NDR and SOC teams must therefore look at context and behavioural models rather than merely spotting periodic connections.

### Why Does C2 Traffic Try to Look Like Normal Traffic?

Internet access in corporate networks usually takes place over particular protocols.

HTTP and HTTPS are the most common examples.

Attackers therefore try to make their communication resemble normal web traffic.

Because entirely different and unusual protocols are far easier to notice.

This reveals an important security truth:

**The use of HTTPS does not mean the traffic is safe.**

HTTPS only shows that the communication is encrypted.

The purpose of the connection may be good or bad.

In network security, therefore, different signals such as;

destination reputation,

DNS behaviour,

traffic frequency,

endpoint context,

TLS metadata

must be assessed together.

### The Relationship Between DNS and C2

DNS is one of the fundamental services of every corporate network.

DNS queries are generated constantly so that users can reach websites.

DNS traffic is therefore extremely heavy.

Attackers can try to hide their communication behaviour inside that volume.

From the defensive side;

unusual domain queries,

newly registered domains,

very long or abnormal subdomain structures,

high-frequency DNS queries,

domain access inconsistent with endpoint behaviour

can all be valuable signals.

**DNS security** is therefore an important component of modern C2 detection processes.

### What Is a Domain Generation Algorithm (DGA)?

Rather than using a fixed C2 domain, some malware can generate large numbers of domain names algorithmically.

This approach is known as a **domain generation algorithm (DGA)**.

The aim is to make it harder for security teams to cut the communication channel entirely by blocking a single domain.

Defensive systems can assess DGA behaviour through signals such as;

domain structure,

DNS query patterns,

reputation,

domain age.

Threat intelligence and DNS analytics therefore play an important role in C2 detection.

### Why Does Domain Age Matter?

Newly registered domains are not always bad.

A company may launch a new product.

It may start a new campaign.

But in cyber attacks, newly created domains can be used for phishing or C2 infrastructure.

**Newly registered domains (NRD)** can therefore be used as a risk signal in SOC systems.

Domain age alone may not be enough to raise an alert.

But when;

a domain seen for the first time,

recently registered,

an unusual endpoint connection,

suspicious process behaviour

appear together, the risk level rises.

### What Is a C2 Framework?

Various **command & control framework** solutions can be used in Red Team operations to simulate genuine attacker behaviour safely.

These platforms can help Red Team teams;

manage simulations centrally,

control operational activity,

execute the defined test scenarios.

That is their role.

But the value of a professional Red Team engagement does not come from the C2 tool used.

What really matters is:

**whether the organisation's security controls can detect the simulated attacker behaviour.**

C2 simulation is therefore not a tool test but a **detection & response validation** exercise.

### What Is Defense Evasion?

Another MITRE ATT&CK tactic closely related to persistence and C2 is **defense evasion**.

The attacker's aim is to make detection by security technologies and security teams more difficult.

Attacker behaviour therefore tries;

to use legitimate system tools,

to resemble normal user activity,

to move low and slow.

Each choice reduces the noise they make.

This approach matters particularly with advanced threat actors.

It is one of the reasons signature-based security mechanisms alone fall short defensively.

### What Is a Low and Slow Attack?

Rather than attacking dozens of systems quickly, some attackers move at low intensity over a long period.

This is generally called **low and slow** attack behaviour.

The aim is to avoid creating large, obvious anomalies.

Instead of connecting to a hundred systems in a short time, for instance;

the attacker may investigate a few systems over the course of days.

This makes detection difficult for security teams.

Because each individual activity can look normal.

Long-term telemetry and behavioural correlation are therefore important.

### Living off the Land and C2

One of the important approaches used by modern attackers is **living off the land (LotL)**.

Instead of running new and easily detectable tools, the attacker can abuse legitimate tools already present in the operating system or the organisation.

This approach can be seen at different attack stages such as;

persistence,

execution,

discovery,

lateral movement,

command & control.

The tooling is already trusted.

Defensive teams must therefore ask not only “which file ran?” but also;

**“Is it normal for this user to perform this operation with this tool?”**

### How Does EDR Detect Persistence and C2 Behaviour?

**Endpoint detection and response (EDR)** systems provide important telemetry for observing endpoint behaviour.

For example;

process creation,

registry changes,

service activity,

scheduled task operations,

network connections,

script behaviour

can all be analysed.

This data can help detect persistence or C2 behaviour.

But EDR alone may not see the whole picture.

NDR or proxy logs may be needed to see the network-side characteristics of C2 communication, for example.

The XDR approach therefore aims to assess different security signals together.

### Why Does XDR Matter?

**Extended detection and response (XDR)** aims to correlate signals from different security domains such as endpoint, network, identity, email and cloud.

Consider an attack chain:

A phishing email arrives.

The user account is compromised.

Suspicious behaviour appears on the endpoint.

A new external connection begins.

Authentication activity changes.

Each of these events may be visible in a different security system.

The purpose of the XDR approach is to turn them into a single attack story.

XDR can therefore provide an important advantage for persistence and C2 detection.

### How Is NDR Used in C2 Detection?

**Network detection and response (NDR)** focuses on detecting anomalous and attacker behaviour by analysing network traffic.

NDR is particularly important for C2.

Because even if the attacker tries to remain invisible on the endpoint, they leave traces on the network when they need to communicate with an external system.

NDR can analyse signals such as;

unusual destinations,

beaconing behaviour,

anomalous DNS,

unexpected protocol usage,

network traffic patterns.

EDR and NDR are therefore not alternatives to one another but complements.

### Can a Firewall Stop C2 on Its Own?

A firewall is an important part of the security architecture.

But it may not be enough on its own against modern C2 behaviour.

Because attackers can use normally permitted protocols such as HTTPS or DNS.

Alongside the firewall, therefore, controls such as;

DNS security,

a secure web gateway,

a proxy,

NDR,

EDR/XDR,

threat intelligence

are important.

The strongest approach is a structure in which the different layers feed one another.

### How Is Threat Intelligence Used for C2 Detection?

**Cyber threat intelligence (CTI)** can help identify known attacker infrastructure.

Threat intelligence sources may contain indicators such as;

malicious IPs,

domains,

URLs,

file hashes,

certificates,

malware infrastructure.

These are generally called **indicators of compromise (IOCs)**.

Firewalls, SIEM, EDR, NDR and other security systems can use these IOCs to try to detect known threat infrastructure.

But IOC-based detection alone is not enough.

Because the attacker can change their infrastructure.

In the modern threat intelligence approach, therefore, **tactics, techniques and procedures (TTP)** knowledge matters alongside IOCs.

### What Is the Difference Between an IOC and a TTP?

An IOC is an observable technical indicator relating to an attack.

For example;

an IP address,

a domain,

a hash,

a URL

can each be an IOC.

A TTP describes how the attacker behaves.

For a particular threat actor;

which initial access technique they use,

which persistence methods they prefer,

which C2 behaviours they employ

is TTP knowledge.

IOCs can change quickly.

TTPs generally remain meaningful for much longer.

Behaviour-based TTP detection is therefore becoming increasingly important in detection engineering work.

### How Does a SOC Detect Persistence Activity?

SOC teams can assess persistence behaviour across different data sources.

For example;

unexpected user creation,

privileged group changes,

new services,

scheduled task activity,

startup changes,

OAuth application changes,

mail forwarding rules

can all be important signals.

But not every change is an attack.

It therefore matters;

who made the change,

from which device,

at what time,

against which change record,

within which business process.

This approach can be considered **context-aware detection**.

### How Does a SOC Detect C2 Behaviour?

C2 detection requires different data sources.

The SOC can assess sources such as;

DNS logs,

firewall records,

proxy logs,

EDR network telemetry,

NDR data,

threat intelligence

together.

A single HTTPS connection may be normal.

But;

a new domain,

a connection repeating every five minutes,

traffic despite no user activity,

a link to a suspicious process

together raise the likelihood of C2.

Attack detection can therefore be strengthened through the **correlation of multiple weak signals** rather than a single alert.

### Why Does Detection Engineering Matter for Persistence and C2?

Simply buying a SIEM or an EDR does not mean good detection.

The organisation must develop detection scenarios suited to its own environment.

Detection engineering teams assess;

which telemetry exists,

how a given MITRE ATT&CK technique would appear,

which alert is valuable in which context,

the false positive rate.

All of it environment-specific.

Red Team operations then verify whether those detections actually work.

There is therefore a strong relationship between Red Teaming and detection engineering.

### What Does a Red Team Measure in C2 Testing?

In a professional Red Team operation, establishing C2 should not be considered a “success” in itself.

The real questions are these:

#### Did the firewall see the connection?

#### Did NDR detect the anomaly?

#### Did the EDR correlate the network behaviour?

#### Did DNS security raise an alert?

#### Did the SIEM correlate the events?

#### Did the SOC notice the attack?

#### How long did it take for the C2 channel to be blocked?

These questions turn C2 testing into genuine **security validation** of the organisation's detection and response capability.

### Why Does Time to Detect Matter for C2?

In cyber security, the attack never happening is the ideal outcome.

But in the real world it may not be possible to prevent every attack.

**Mean time to detect (MTTD)** is therefore an important metric.

When an attacker's C2 communication begins, how long does the organisation take to see it?

Minutes?

Hours?

Days?

Weeks?

That period directly affects what the attacker can do in the environment.

The longer the detection time, the more opportunity the attacker has to carry out activity such as;

discovery,

credential access,

lateral movement,

collection.

Time is entirely on their side.

### What Is Dwell Time?

**Dwell time** describes the period an attacker remains undetected in an environment.

The longer the dwell time, the more time the attacker has to learn the environment and reach their objectives.

One of the valuable outputs of a Red Team operation is therefore not only the question “was the attack successful?”.

This question matters too:

#### How long could the attacker move without being noticed?

This metric is an important indicator of SOC maturity.

### What Should Be Done to Reduce Persistence and C2 Risk?

Organisations need a layered security approach to reduce these risks.

In particular;

#### EDR/XDR

monitoring endpoint behaviour,

#### NDR

analysing network behaviour,

#### SIEM

correlating different telemetry,

#### DNS Security

examining suspicious domain behaviour,

#### Identity Security / ITDR

monitoring account and privilege changes,

#### PAM

controlling highly privileged accounts,

#### Application Control

restricting unexpected application behaviour,

#### Threat Intelligence

tracking known attacker infrastructure,

#### Detection Engineering

developing behaviour-based detections,

#### Threat Hunting

proactively searching for hidden attacker behaviour

should all be considered together.

### How Should Persistence Be Handled During Incident Response?

In a cyber incident, deleting the first malware file is not enough.

The incident response team must ask these questions:

#### Was a new user created?

#### Was any privilege change made?

#### Is there a new service or scheduled task?

#### Did any cloud IAM change take place?

#### Was an OAuth application added?

#### Was mailbox forwarding created?

#### Is similar behaviour present on other endpoints?

This approach helps clean up the attacker's various persistence points.

Otherwise the attacker can return once the first system has been cleaned.

### How Should Persistence and C2 Be Presented in a Red Team Report?

A professional Red Team report should not contain merely a list of technical methods.

On persistence and C2 the report can include:

#### Persistence Objective

The method by which access could be maintained.

#### C2 Communication

Which security layers the communication passed through.

#### MITRE ATT&CK Mapping

The relevant persistence and command & control techniques.

#### Detection Timeline

When the EDR, NDR or SOC noticed the attack.

#### Security Control Effectiveness

Which control succeeded or failed.

#### Dwell Time

How long the simulated attacker could remain unseen.

#### Remediation

Recommendations that would break the attack chain.

This structure turns a technical finding into a measurement of corporate cyber resilience.

### Why Do Persistence and C2 Matter for Management?

These two concepts may look highly technical, but they relate directly to business risk.

An attacker remaining unnoticed inside systems for a long period can;

examine sensitive information,

analyse user accounts,

discover critical systems,

prepare a broader attack.

All of it quietly.

The core risk for an organisation is therefore not only:

**“Did an attacker get in?”**

The real question is:

**“Once inside, how long could they remain unnoticed?”**

Dwell time and time to detect are therefore important cyber security indicators that can be tracked at management level.

### Conclusion: Keeping the Attacker Out Is Not Enough — You Must Also Stop Them Staying In

In modern cyber security, defence does not consist of perimeter security alone.

The firewall may be strong.

MFA may be in use.

An EDR may be installed.

But once the attacker gets past that first defensive layer somehow, the organisation's second question must begin:

**“Can we see them inside?”**

Persistence lets the attacker maintain their access.

Command & control makes that access remotely manageable.

The organisation's security architecture must therefore work across the;

endpoint,

network,

identity,

cloud,

email,

SOC

layers together.

A strong defence model does not merely make it harder for the attacker to enter the system.

**It also makes it harder for them to stay inside, to communicate and to move unseen.**

Red Team and Purple Team operations gain their value precisely here.

Because by simulating real attack behaviour in a controlled way, the answers to these questions can be measured:

#### Can we see persistence behaviour?

#### Can we detect C2 communication?

#### How quickly does the SOC respond?

#### What is the attacker's dwell time?

But there is another dimension to understanding all this technical behaviour.

Who is the attacker facing the organisation?

What do they want?

Which sector do they target?

Which techniques do they prefer?

Which infrastructure do they use?

These questions take us to the second great field of Red Teaming:

**Cyber threat intelligence.**